Your friend should cancel his credit card immediately. There's a 99% chance he didn't actually buy any type of Anti-virus or malware program.
These are just the new "scam" right now. A fake anti-virus program tells you your computer is infected, it pretends to go through your hard drive checking to see how many infections you have (don't worry, it's not actually going through your hard drive at this point), and then tells you that you need to purchase their anti-virus software of malware program to "fix" your computer.
Now they have your credit card and will either use it online, or sell it to others who will use it maliciously.
Anytime this happens, your best option is to completely turn off your computer. Clicking anywhere on the pop up or ad can activate the virus to a further extent. Your best bet is to get on another computer and google the exact name of the fake anti-virus program and you can usually find a relatively quick fix for it. As another poster alluded to, you will likely have to try and fix your computer in Safe Mode, when you start it back up.
NEVER give them your credit card info.